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(57) Abstract 



Method for enabling a user of a system to obtain access to one or more services, for example for enabling a caller to access some 
information on a remote server. The method comprises the following steps: the system first prompts the caller to identify himself by 
entering a subscriber code (121). A speaker verification is then made using a voice comparison between the caller s voice and a voice 
reference (123) associated with the subscriber the caller claims to be. Access to the requested services is given if the outcome of said voice 
comparison is positive; if the system does not store a sufficiently good voice reference to verify the identity of the subscribe r the user claim 
to be with a predetermined degree of reliability, the caller is prompted to enter a confidential PIN code (122). If the PIN code entered is 
correct, access to the requested services is given and a new voice reference is stored. 
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Speaker Verification Method 

The invention relates to a method for enabling a user of a system to 
obtain access to one or more services according to the preamble of claim 1 . 

In many situations, it is necessary to identify users before giving 
5 them access to services or systems. These services include remote access to 
computers, electronic banking transactions, security access control for build- 
ings, etc. In the same way, for many new telephone services it is necessary to 
verify unambiguously the identity of the caller. The caller identity usually cannot 
be determined from the access point in the telephone network used by the 
10 caller, as a caller may want to access those services from different access 
points. 

An object of the present invention is to provide a method for enabling 
a user of a system to be identified and thus to obtain access to one or more 
services in a convenient way. 

15 in a well-known method used for identifying a user in a system, the 

user is first requested to identify himself by entering a personal identification 
code (ID). The user is then requested to enter a secret password used to verify 
the claimed identity. Access to the requested services is given only if the en- 
tered password matches the entered ID. This is the method, for example, for 

20 using the calling cards proposed by many different telephone network opera- 
tors. A subscriber who wants to use the service is usually furnished with a card, 
for example in credit card format, on which a subscriber code or number is 
printed. Furthermore, the subscriber is given a confidential personal identifica- 
tion code (PIN code) he has to remember. The subscriber code is needed for 

25 identifying the subscriber and the PIN code for verifying the entered identity. 

To use the service, the subscriber calls a toll-free telephone number 
which connects him to the server which implements the calling card service. 
Once the call setup has been established, a speech generator in the server 
prompts the caller to enter first his subscriber number (which is printed on the 
30 card he has previously bought), and then his confidential PIN code. Those 
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numbers may be entered manually on the telephone keyboard or, more com- 
fortably, orally. In this latter case, the digits are recognized by a speech recog- 
nizing algorithm implemented in the server. 

If the server recognizes the subscriber number entered and if the 
5 entered PIN code matches this subscriber number, the subscriber can then be 
connected to another subscriber within the network. The invoice for the tele- 
phone call will be sent automatically to the calling subscriber, independently of 
the place from which the call was made. 

This method is very tedious for the subscriber who has to enter suc- 
10 cessively two numbers, one of which has to be memorized. The security is not 
optimal, as very often the PIN code is written down near or on the card. 

The U.S. Patent No. 5,297, 194 describes a method in which the sub- 
scriber is prompted to enter one unique password digit-by-digit. A speech rec- 
ognition algorithm running on the digital processing system of the server 

15 processes the information received and, using a statistical recognition strategy, 
determines the digits. After all digits have been recognized, and if the password 
is valid, the server uses a speaker verification algorithm to determine if the 
entered password has been spoken by a caller whose voice has been previ- 
ously assigned to the password. Access to other services is allowed only if the 

20 verification algorithm establishes a match; otherwise, the system rejects the 
access inquiry and the call is terminated. 

This method generally requires the subscribers to have previously 
enrolled in the system. Accordingly, the speaker verification algorithm uses a 
voice reference database comprising voice references collected from all 
25 authorized subscribers. Enrollment is accomplished by having the subscriber 
repeat a multidigit password several times. A voice reference is then obtained 
from those utterances. This voice reference is assigned to the password attrib- 
uted to the subscriber. 

This method requires active collaboration of the user at the time of 
30 enrollment and thus discourages in particular new subscribers. Moreover en- 
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rollment is generally carried out in a single session from a single telephone ap- 
paratus, for example from the telephone at the address of the new subscriber. 
The quality of the voice reference registered therefore very much depends 
upon the characteristics of the telephone apparatus originally used, and the 
5 subscriber risks not being recognized if he later calls from a different telephone. 

Other speaker recognition methods and algorithms are described by 
George R. Doddington in "Speaker Recognition - Identifying People by their 
Voices", Proceed-ings of the IEEE, vol. 73, No. 11, Nov. 1985, pp. 1651-1664; 
by John Oglesby in "What's in a number? Moving beyond the equal error rate", 
10 Speech Communication, vol. 17, 1995, pp. 193-208; and by Sadaoki Furui, in 
"An overview of Speaker Recog-nition Technology", ESCA Workshop on Auto- 
matic Speaker Recognition, Identification and Verification. 

The object of the present invention is to provide an improved method 
for enabling a user of a system to obtain access to one or more services. 

15 This object is attained according to the invention by means of sup- 

plementary steps as set forth in the characterizing part of claim 1 . 

Preferred embodiments of the invention follow from the dependent 

claims. 

According to the invention, a subscriber receives a subscriber code 
20 and a confidential PIN code, as in the prior art. The subscriber code serves to 
identify the subscriber and the PIN code to verify the claimed identity. 

To use the service, the user is first prompted (for example by a 
speech generator) to enter his subscriber code. This number may, for example, 
be printed on a subscriber card he has previously bought. A speaker verifica- 
25 tion algorithm is then used for verifying the identity claimed by the user by 
making a voice comparison between the user's voice and a voice reference 
stored in the system and associated with the subscriber code entered by the 
user. Access to the requested services is given if the user's voice matches said 
voice reference. 
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If said voice reference is not good enough to verifiy the claimed 
identity with a prescribed degree of reliability, the user is then prompted to enter 
his confidential PIN code. The PIN code is then checked, and, if the outcome of 
this check is positive, a new voice reference is created in a background process 
5 and associated with the subscriber code entered by the user. 

One advantage of the invention, especially if used for identifying 
callers in a telephone network, is that the voice reference is created and stored 
during several sessions, usually from different locations and with various tele- 
phone apparatus. Thus, the voice reference stored for a given subscriber 
10 usually takes very different environmental conditions (noise, telephone lines, 
microphone, etc.) into account. 

According to the invention, a specific enrollment session is not 
needed. Therefore, the method is very user-friendly, especially for new sub- 
scribers. 

is In the same way, the voice reference created takes into account 

possible user speech variations between two sessions. For example, it happens 
often that the user's voice is less sure and quick during the first session than 
during subsequent ones, when the user feels more confident. 

It is possible to use a very high number of utterances for the voice 
20 reference without making the procedure too uncomfortable for the user. Even if 
the voice reference is already sufficiently good for a reliable verification of the 
user's identity, it ish still possible to take new utterances into account in order to 
improve even more the quality of the voice reference and to adapt it to the 
user's voice variations. 

25 An embodiment of the invention is described below, by way of 

example only, and illustrated by the figures which show: 

Figure 1 is a flow chart of this embodiment, 



WO 98/16906 



5 



PCT/EP96/04480 



Figure 2 is a partial flow chart of the steps undertaken by the server 
when it has not stored sufficient reference voice parameters to recognize the 
subscriber with sufficient security, 

Figure 3 is a partial flow chart of the steps undertaken by the server 
when it has already stored sufficiently good reference voice parameters to rec- 
ognize the subscriber with a prescribed degree of reliability, 

Figure 4 shows the structure of a database set up according to the 
method of the present invention. 

Before the different steps of the method according to the invention 
are explained in detail, a database 120, used for implementing the method ac- 
cording to the invention, will be described, with reference to Figure 4. Each 
record of the subscriber database corresponds to one subscriber and contains 
all information needed to identify and verify the identity of the user. The asso- 
ciated record for each subscriber includes a subscriber code field 121, a PIN 
code field 122, a voice reference field 123 and a reference flag 124. The sub- 
scriber code field 121 includes enough digits to designate unambiguously each 
subscriber. In this example, the subscriber code field includes alphanumerical 
digits; however, in many applications, only numbers will be allowed. PIN code 
field 122 includes enough digits to verify the claimed identity of the user with a 
prescribed degree of reliability which may depend on the application. Again, 
digits can be either alphanumerical or just numerical. The voice reference field 
123 stores a voice reference corresponding to the subscriber. Depending on 
the speaker verification algorithm used, the voice reference field may store 
several samples of the voice (utterances) of the subscriber, one sample ex- 
tracted from one or several utterances, or one or several parameters extracted 
from one or several previous utterances of the subscriber. Reference flag 124 is 
a single bit indicating if the voice reference stored in field 123 is of sufficiently 
good quality to verify the identity of the subscriber with the prescribed degree of 
reliability. 
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The method used by the system will now be explained with reference 
to Figures 1 to 3, which relate more particularly to caller identification in a tele- 
phone network. 

A user wishing access to the services offered calls the server imple- 
5 menting the method of the present invention (step 2). During step 4, the user is 
first greeted and then prompted to enter his subscriber code (or some other 
form of identification data). 

Preferably, the subscriber code is entered orally, for example se- 
quentially and digit-by-digit. Alternatively, the subscriber code may be entered 
10 manually with a keyboard, for example on the user's receiver. In this latter case, 
the user will be prompted to say something, for example to repeat a standard 
sentence. 

The next step 6 consists in subscriber identification. If the subscriber 
code is entered orally, subscriber identification implies speech recognition to 

15 extract the subscriber code from the sentence spoken by the user. If the sub- 
scriber code is entered manually using the keyboard on the receiver, the gen- 
erated pulses or tones are used to determine the digits of the subscriber code. 
Steps 4 and 6 could possibly be repeated several times until the transmission 
quality is sufficiently good for identifying the subscriber code. As a different 

20 subscriber code is assigned to each different subscriber, after step 6 the sys- 
tem knows the identity claimed by the user. 

A test is made during step 8 to check if a voice reference 123 has al- 
ready been assigned in database 120 to the subscriber the user claims to be. If 
the outcome of this test is negative, phase A is executed, described below in 

25 connection with Figure 2. On the other hand, if a voice reference 123 has al- 
ready been assigned to the identified subscriber, the reference flag 124 is 
checked during step 10. We will see below that this flag is set to 1 if, and only if, 
the voice reference 123 assigned to the subscriber is sufficiently good 
(depending on the algorithm used) in order to verify his identity with the desired 

30 degree of reliability. 
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If the reference flag 124 was at 0, phase A, discussed below in rela- 
tion to figure 2, is executed (step 20); on the other hand, if it was set to a posi- 
tive value, phase B, discussed below in relation to figure 3, is executed (step 
30). 

5 The reference flag 1 24 can also be set to 0 each time a new sub- 

scriber is stored in the database. In this case, it is possible to bypass the test 8. 

Phase A will now be described in relation to figure 2. Phase A is 
executed when no voice reference 123 has been assigned to the subscriber in 
the database 120, or when the voice reference stored is not sufficiently good to 
10 verify the identity of the subscriber with the prescribed degree of reliability. After 
a few calls, the identity of the subscriber will be verified automatically from the 
subscriber's voice, and this phase will no longer be executed. 

At beginning of phase A, during step 21 , the user is prompted to 
enter his PIN code. This PIN code is confidential; it can either be entered orally 

is or preferably manually using the keyboard on the receiver. In the first case, a 
speech recognition algorithm is used to recognize the orally entered PIN code; 
in the second case, the PIN code is determined from selection pulses or tones 
generated manually with the keyboard. During step 22, a verification is made to 
check if the PIN code entered by the user matches the PIN code 122 assigned 

20 to the subscriber the user claims to be. If the PIN code is wrong, access to 

services is denied and the call is terminated (step 23). In a variant embodiment, 
the user may have a second or even a third chance to re-enter his PIN code if 
the first try failed. 

On the other hand, if the PIN code is correct, access is given to the 
25 requested service (step 25). Depending on the application, the service can be 
connection with another network subscriber, access to a database, electronic 
funds transfer, credit card validation, subscriber personal identification, invoic- 
ing of the call on the user's account with the network provider, etc. However, it 
should be noted that the invention is not limited to these applications, which are 
30 given as examples only. 
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In a background process (step 24), and simultaneously with step 25, 
a new voice reference is created using the user's voice sample (utterance) and 
assigned to the subscriber (field 123). Step 26 is a test to check if the voice ref- 
erence created is now sufficiently good to verify the subscriber with the 

5 prescribed degree of reliability. What is meant by "sufficiently good" depends on 
the algorithm used for voice verification; the prescribed degree of reliability 
obviously depends on the application. It is possible for instance to determine 
that the voice reference is sufficiently good if it has been created from a 
minimum number of utterances, for example ten. In this case, the voice refer- 

10 ence associated with each user is regarded as good enough as soon as said 
user has had access to the system 1 0 times or more. Counting means are nec- 
essary which store in an additional field associated with each subscriber code 
121 the number of accesses entered by this subscriber. Alternatively, it is pos- 
sible according to the speaker verification algorithm used to determine directly 

15 from certain parameters of the voice reference 123 whether the latter is suffi- 
ciently good. In the case of a negative response, the reference flag 124 
corresponding to the subscriber is set or kept at zero in the course of step 27. 
On the other hand, if the voice reference is now sufficient, the reference flag 
124 is set to 1 in the course of step 28. In this case, at the time of subsequent 

20 calls of the subscriber, only the subscriber code is required, as a rule, and, in- 
stead of phase A, the system carries out phase B, which will now be discussed 
in relation to Figure 3. 

Phase B is carried out for calls of subscribers for whom the voice is 
sufficiently known to permit a sufficiently reliable verification of identity. In the 

25 course of step 31 , the subscriber identity claimed by the user is verified using a 
speaker verification algorithm. In so doing, a comparison is made between the 
user's voice utterance and the voice reference 123 assigned in the system to 
the claimed subscriber. Any algorithm for verification of a known person can be 
used, for example an algorithm such as is described in one of the aforemen- 

30 tioned documents to verify whether the user's utterance matches the voice ref- 
erence associated with the subscriber code 121 entered by the user. 

If the outcome of this test (step 32) is alright, i.e. if the identity of the 
user has been verified, access is given to the requested services (step 35). If, 
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on the other hand, the entered voice cannot be matched substantially to the 
voice reference assigned to the claimed subscriber, access to the requested 
services is denied and the call is terminated (step 33). In a variant embodiment, 
phase A is executed, instead of step 33, when the user's identity cannot be 
verified from his voice. In this case, as described above, the user is prompted to 
enter his PIN code. 

In a preferred embodiment of the invention, the user's utterance is 
used to create a new voice reference 123 in a background step 34, even if the 
voice reference assigned to the subscriber is already sufficiently good. This 
new voice reference is stored in field 123 associated with the subscriber code 
121 entered by the user. In this way the system adapts progressively to varia- 
tions in the voice of the subscriber owing to aging, seasonal temperature varia- 
tions, different telephone apparatus, etc. 

The above description relates in particular to use of the method in a 
is telephone network. It is clear, however, that the invention can also be applied to 
other types of transactions or networks. For example, the invention can also be 
used for the verification of identity in automatic teller machines or in access 
control devices. 



10 
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Claims 

1 . Method for enabling a user of a system to obtain access to one or 
more services, comprising at least the following steps: 

- prompting (4, 6) the user to identify himself with a subscriber code 

5 (121); 

-subscriber verification (31 ,32) during which the user's voice is com- 
pared with a voice reference (123) associated with the subscriber code (121) 
entered by the user, access to the requested services being given if the user's 
voice matches said voice reference; 

io characterized by following supplementary steps undertaken when 

the voice reference (123) associated with the subscriber code (121) entered by 
the user is not sufficiently good to verify the subscriber's identity with a prede- 
termined degree of reliability: 

-prompting said user (21) to enter a PIN code (122); 

is -comparing (22) said PIN code entered by the user with a PIN code 

(122) associated with the subscriber code (121) entered by the user, 

-if the PIN code entered by the user matches the PIN code (122) as- 
sociated with the subscriber code (121) entered by the user, giving access (25) 
to the requested services and creating (24) a new voice reference (123) which 
20 is associated with the subscriber code (121) entered by the user. 

2. Method according to claim 1 , in which the user is prompted to 
enter his subscriber code (121) orally, a speech recognition algorithm being 
used to recognize the subscriber code entered. 

3. Method according to claim 1 , in which the user is prompted to 
25 enter his subscriber code (121) on a keyboard, tones or pulses generated by 
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typing the keyboard being used to recognize the subscriber code, and in which 
the user is prompted to speak a sentence allowing speaker verification. 

4. Method according to one of the preceding claims, in which the 
user is prompted to enter his PIN code (122) when the user's voice does not 

5 match said voice reference (1 23) associated with the subscriber code (121) 
entered by the user, access to the requested services being given if the PIN 
code entered by the user matches the PIN code (122) associated with the sub- 
scriber code (121) entered by the user. 

5. Method according to one of the preceding claims, in which the 

io user is prompted to enter his PIN code (122) orally, a speech recognition algo- 
rithm being used to recognize the PIN code entered. 

6. Method according to one of the preceding claims, in which the 
user is prompted to enter his PIN code (122) on a keyboard, tones or pulses 
generated by typing the keyboard being used to recognize the subscriber code 

15 entered. 

7. Method according to one of the preceding claims, in which a new 
voice reference (123) is created (34) and associated with the subscriber code 
(121) entered by the user when the user's voice matches said voice reference 
(123) associated with the subscriber code (121) entered by the user. 
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